Consentfolio PECR Fines and Penalties for Cookies (2026)
The Data (Use and Access) Act 2025, which came into law on 19 June 2025, aligns PECR penalties with the UK GDPR: a maximum of £17.5 million or 4% of global annual turnover, whichever is higher, up from the previous £500,000. It also removes the old requirement to show substantial damage or distress before the ICO can act. The ICO has said it will publish new PECR enforcement guidance once the new regime is in force, and in the meantime it reserves monetary penalties for the most serious infringements.
The size of the maximum is the headline. How the ICO has used its powers so far is the context you need to read alongside it.
What the DUAA 2025 changes
| Before DUAA 2025 | Under the DUAA 2025 | |
|---|---|---|
| Maximum fine | £500,000 | £17.5m or 4% of global turnover, whichever is higher |
| Damage threshold | Had to show substantial damage or distress | Removed; the contravention itself can be actionable |
| Alignment | Separate, lower PECR regime | Matches UK GDPR penalties |
The ICO has confirmed the enforcement regime is changing to align with the UK GDPR and that it will issue new PECR enforcement guidance once the new regime is in force.
How the ICO has enforced cookies
The ICO's recent approach on cookies has been pressure before penalties. It ran a compliance sweep of the UK's most-visited sites, contacting the top 200 and then widening to around 1,000 sites, and reported that several hundred improved their banners after receiving compliance letters. A follow-up review still found many sites using non-compliant banners.
To date, that campaign has relied on warnings and compliance letters rather than monetary fines for cookie banners specifically. The direction of travel is clear, though: a far higher ceiling, a lower threshold to act, and a regulator that has already mapped which large sites fall short. Treat the absence of cookie fines so far as a grace period, not a guarantee.
What this means for your site
The practical response has not changed: block non-essential cookies before consent, show an equal-prominence banner, and keep records you can produce. See UK cookie law explained and how to prove cookie consent. The stakes for getting it wrong are simply higher than they were.
Sources
- Data (Use and Access) Act 2025 (legislation.gov.uk)
- PECR (legislation.gov.uk)
- ICO: enforcement action
Frequently asked questions
What is the maximum PECR fine? Under the DUAA 2025, which aligns PECR with the UK GDPR, up to £17.5 million or 4% of global annual turnover, whichever is higher. The previous maximum was £500,000. The ICO will issue new PECR enforcement guidance once the new regime is in force.
Has the ICO fined anyone for a non-compliant cookie banner? Its recent cookie compliance work has used warnings and compliance letters rather than monetary fines. The raised ceiling and lower threshold mean that could change.
Do I have to prove damage before the ICO can act? Not any more. The DUAA 2025 removed the requirement to show substantial damage or distress, so a contravention can be actionable on its own.
Written by Tudor Rusmanica, founder of Consentfolio. Tudor has spent over a decade in agency SEO, working where search performance meets data protection: the analytics, tagging and consent setups that keep measurement useful and lawful. Connect on LinkedIn.
Published 13 July 2026. This guide is general information, not legal advice.